Security and compliance for container-based microservices
summary
Government team runs Notify (50M messages) and a COVID Alert server that records 2.5 billion API requests, 150 TB transferred, 130 releases, zero downtime, proving containers at scale work. Recommendations are concrete: use multi-stage builds, Git-SHA image tags, SBOMs; scan images with ECR plus Amazon Inspector scanning (Clair for basic), lint Dockerfiles with Hadolint, enforce policies with Kyverno/OPA, use Secrets Manager/External Secrets, apply seccomp/AppArmor, prefer Bottlerocket or Fargate hosts, and automate blue‑green/canary deploys and GitOps (Flux/Argo) for rapid, safe rollbacks.
AI-written summary · about
chapters (20)
- 0:00Start
- 0:07Security and Compliance for Container-Based Microservices
- 0:59Best Practices on Container Security
- 2:53Canadian Digital Service
- 3:17Gc Notify
- 7:02Managed Kubernetes
- 9:25Multi-Stage Builds
- 10:34Base Image Matters
- 13:16Automate the Build and Deploy Process
- 15:49Keep a Lookout for Unusual Behavior
- 23:23Container Images
- 28:56Basic and Enhance
- 29:11Enhanced Scanning
- 33:35Recap Reduce Reuse and Recycle
- 35:41Integration with Aws Secrets Manager
- 36:01Limit Container Resources
- 36:37Do Not Run Your Containers as Root
- 38:20Dirty Containers
- 42:09Container Hosts
- 44:53Third-Party Software Solutions
related talks
40mSecuring Containers on the High Seas
27mContainer Security Best Practices
37mAchieving High Security at Scale with Microservices
21mHow containers make security and compliance instantly easier
15mContainerization and micro-services in real life change security and vulnerability management
48mBuilding GDPR, ISO27001 Containerized Application for continuous compliance
53mAppSec & Microservices
46mWhat Security People Want: Making DevSecOps Happen with Containers